Hey folks, I have a weird one. We use dockutil to manage Dock. Dockutil installation + sorting out the Dock is set as a policy after enrollment. Policy deploys fine, installs Dockutil, adds the required icons but doesn't remove any of them with error 'Remove failed for xxx in /User/Username/Library/Preferences/com.apple.dock.plist'. Although, same script is added to our SelfService and when its run from there, it works as a charm.  #!/bin/bash echo "running dockutil" DOCKUTIL=/usr/local/bin/dockutil $DOCKUTIL --remove 'Safari' --allhomes $DOCKUTIL --remove 'Mail' --allhomes $DOCKUTIL --remove 'Contacts' --allhomes $DOCKUTIL --remove 'Calendar' --allhomes $DOCKUTIL --remove 'Photos' --allhomes $DOCKUTIL --remove 'Messages' --allhomes $DOCKUTIL --remove 'FaceTime' --allhomes $DOCKUTIL --remove 'iTunes' --allhomes $DOCKUTIL --remove 'iBooks' --allhomes $DOCKUTIL --remove 'Maps' --allhomes $DOCKUTIL --remove 'TV' --allhomes $DOCKUTIL --remove 'Music' --allhomes $

Greetings,We are starting our setup for Jamf Connect and so far the login window is working, though on one M1 Mac Studio, it keeps asking for password verification each login. I read in another thread that is firmware issue?My main question is that we are having issues with the Connect App not loading. It seems to work sometimes but most times it loads we get the attached image. App with empty menu items.I can upload the plist from the config file if needed. But I'm at a loss for how to fix the issue.

There has been a request to create a restriction on certain students' iPads to prevent them from disrupting the class. This looks, to me, like a student behavior issue and not a technology problem. Even so, I will like to see if this is possible. The teacher setup is as follows: Teachers connect their MacBooks to the projector via HDMI to teach the class. Here is the issue: students can start "Screen Mirroring" (to the teacher's MacBook) from their iPads triggering the "Join" code to overtake the class screen and interrupt the class. I will assume that if something can be done it will take a "Configuration Profile" scoped to the incurring student's iPads in order to block the Screen Mirroring from being available on the iPad. I have only found some restrictions for "Airplay incoming requests" and "AirDrop", but, none do the trick. Let me know your thoughts!

Hello - I'm sending remote commands to 7000 iPads to update iPadOS on supervised devices>Latest version>Download, install and restart. None of the iPads were updated to 16.5(going on the 14th hour mark since commands were sent). Under Devices>History>Completed Commands, I see 'AvailableOSUpdates' on all the iPads. I am currently on JAMFPro version 10.45. There's no iPadOS defer in place. I've been pushing iPadOS updates throughout the year with no issues until now. Any suggestions? Thank you!

How can I pull the specific insight's non-compliant system list as a csv file or as report in Jamf Protect? is there any options available for this?

Hello,With the new certificate renewal procedure I had to reconnect directly to the Apple site which manages the certificates.The problem is that the specific Apple ID we used for this when originally installing the product, is now asking me for answers to the passphrases we lost. And therefore I cannot access the certificate management.To work around this I used another Apple ID from our company to generate a new certificate.But after installing it in our Jamf server, I notice that the push no longer works: In view of the logs, it comes from the certificate.Is there a way to force Jamf and associated devices to use the new certificate from another Apple account?If not, what is the procedure with Apple to recover the original account that managed the push certificate for our Jamf server?Thanks in advance for your suggestions.Regard's Stéphane

Can anyone explain the Activation code and Licensing? We are licensed for 195 and we are at 195 active computers.  I just received an Activation code for 215 which I added to Jamf Pro in Settings - Activation code.Do I have to update the license configuration file again to have computers update to the 215 licenses?  Is there a document referencing when we get a new activation code and what has to be done for licensing?  

Hi A question: How can I deploy to turn on automatic login for a local user. I found in a other discussion this script but I cant get this working: http://www.brock-family.org/gavin/perl/kcpassword.html What do I have to do to enable the automatic login? I'm a bit confused with this script. Thank you!

What is the best way to identify endpoints with removable MDM profiles? I suspect that some computers in my environment may have been deployed that way before I was hired.

Hello All,Am testing my installation of Jamf Connect. The scripts open an Applescript and the user select Accept to trigger the policy to install Jamf Connect. The log below appears randomly when testing. Could I be missing something in the script to avoid the error?  #!/bin/bash ## This will display a pop up window and freeze Finder. The user will have to click Accept to start the next line 'Start the policy' button=$(/usr/bin/osascript << EOF tell application "Finder" activate display dialog "Jamf Connect is here! Please save your work and click Accept." buttons {"Accept"} with icon POSIX file "/Library/Application Support/SunPower/brandingimage.icns" with title "Important!" end tell EOF) sleep 5 # run policy with returned value /usr/local/bin/jamf policy -event "$button" 

I use Jamf patch management definitions to help with our patching process, as it makes it easy to build the correct Smart Computer Groups using the criteria.I just noticed that the current version of Microsoft Teams (standalone) that can be downloaded from macadmins.software is showing version 1.6.00.11156, or "61156" as the CFBundleVersion displays it. I confirmed this right now by downloading the latest version linked there and examining the pkg in Suspicious Package.Yet, in Jamf's Patch Management, I'm seeing this for versions of Microsoft Teams.There is no version "611156" listed in the patch definition. Am I just missing something or did Jamf miss one of the versions for this title? Maybe 611159 it was supposed to be 611156?This is the first time I've run into a missing version in patch management that I can actually verify is a version I can obtain from the vendor.

I am not sure if it is a coincidence or not, but we have seen the following problem happen on devices after updating to iOS 16.4 +.We have web clips on our devices that point to MS forms pages on our SharePoint environment. They will load once, but any other reloads bring up a blank page. All other web clips (non-Microsoft) work fine. These devices do have a Content Filter Configuration Profile installed on them. When we remove it, the SharePoint web clips work as expected. So the problem is with the filtering. I am hoping someone has had a similar issue and was able to determine the additional site that need to be added for Forms in SharePoint to load properly. I really do not want to enter in the long list of servers that Microsoft has, in the link below. We did test it on Edge, thinking it might be Microsoft being Microsoft, but unfortunately with the same resultsMicrosofts Listing of Servers Did try diagnosing with Charles Proxy and WireShark, but the sites we got th

Hey all,We found that some of the parental controls from screen time on our MacBooks cause issues with test loading in TestNav and we have to disable them.  Im now trying to create an extension attribute to show if the user has screen time enabled so we can send a message to these specific students and parents.During covid we provided instructions for parents to enable screen time on their kids devices, but now have to send messaging out to have them disable it for the tests.Anyone have any suggestions?

I have created and configured a lot of Jamf Pro servers over the years. While creating a new one today to use for testing, I ran into an issue I have never seen before. While following the steps for installing Jamf Pro on Ubuntu I am not prompted to create a root user password during the MySQL install process. I'm also not prompted to use legacy authentication. The Jamf article I am using is here:https://learn.jamf.com/bundle/technical-articles/page/Installing_Java_and_MySQL_on_Ubuntu_for_Jamf_Pro_10-14-0_or_Later.html#concept-5140What, if anything, could I be doing wrong? MySQL installs. I'm just not being prompted. Even though I have followed this process many times I always pull up the instructions published by Jamf to ensure that I complete all steps and catch any new or modified steps. Fortunately I have a snapshot of my server so I can revert back to the base install of Ubuntu quickly.

I'm trying to authenticate against the JSS API URL with a valid login credentials and it seems to constantly fail, e.g. ../JSSResource/accounts with error 401, not authorized. The user has full admin privileges, but continue to fail on the basic auth. I've even tried cURL to see if the behavior is different: $ curl -kvu "jss:****************" -H "Content-type: text/xml" https://jss.*********/JSSResource/accounts * Trying *.*.*.*... * TCP_NODELAY set * Connected to jss.**** (*.*.*.*) port 443 (#0) * ALPN, offering h2 * ALPN, offering http/1.1 * Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH * successfully set certificate verify locations: * CAfile: /etc/ssl/cert.pem CApath: none * TLSv1.2 (OUT), TLS handshake, Client hello (1): * TLSv1.2 (IN), TLS handshake, Server hello (2): * TLSv1.2 (IN), TLS handshake, Certificate (11): * TLSv1.2 (IN), TLS handshake, Server key exchange (12): * TLSv1.2 (IN), TLS handshake, Server finished (14): * TLSv1.2 (OUT),

Having a little trouble finding the correct operations to pull the Warranty info from the API. Im not even sure if it is possible. The reason to do this is to have a popup on a computer, which is coming up to warranty end, to inform the end user to prepare their machine for replacement. If there is a better way to do this please let me know.

 Hi All, I completed my Jamf 200 on July 2020, I didn't take a copy of it. Now I am unable to find it. Can anyone help me where to find it.

Hi!we are facing an issue with ARD that started some months ago, in details:- No issue with ARD MDM command to enable it- Admin login authentication go through- Observe and Control doesn't work, it loads a while and the following error appears: " Make sure the remote computer is available and the firewall is not blocking screen sharing"- In ARD app on "current application" I can see that it shows the APP in use- TCP/UDP ports are all opened. From networks logs we can see that target device is not responding- ARD app release is the latest one 3.9.6- ARD agent is 3.9.8 - Tested on Ventura 13.2.1 / 13.3 / 13.3.1 Does anyone facing the same issue? Any workaround? Thanks! Daniele 

We are an MSP that specializes in macOS and iOS, with macOS devices making up about 50% of total computers we support. Many are in Jamf Pro (separate cloud instances), and of those, the majority are ADE (vs. manually enrolled). All computers have an RMM agent installed, and we are looking to move to a different RMM platform. It would be helpful to know which computers have Jamf via ADE and which do not so we can anticipate which users will have permissions issues due to lack of profile-based PPPC control. Does anyone know of an option within the Profiles command that can identify the presence of the non-removable Jamf "MDM Profile" on a Mac? When I run the "sudo profiles -P" command, I can see all installed profiles. Some have human readable names, while others are just named with GUIDs. Nothing jumps out as the profile I need to verify. If one of the GUID entries is indeed the "MDM Profile" profile, then I'm going to assume the GUID is unique to each Jamf instance.I'm trying to a

Hello, After enrolling the device in pre-stage the username & email are remaining blank.We are using google cloud identity LDAP.Looking forward to feedback. Best Regards,Makarand

Been looking for an EA to pull the last 5 reasons given by a user for account elevation from /private/var/log/privileges.log for awhile, didn't quite have the bash savvy to get exactly what I wanted. Last night I decided to give ChatGPT a shot. First I gave it a summary of what I wanted and told it to hold so I could give it more specific info. I fed it the documentation link for Extension Attributes in the Jamf Pro Admin guide, then provided a sample privileges.log file. After a bit of messing around with the results given by ChatGPT and prompting it to refine its response further it spit out something workable. Here's the final result in Jamf, along with the Extension Attribute script (in zsh).    #!/bin/zsh # ########################################################## # # Jamf Pro Extension Attribute # Last 5 Privileges.app requests.sh # Version 1.0 # 3.29.2023 # # This script records the last 5 reasons an end user needs to request local admin right

I have a "1 Extension Attribute Error" error on Google Drive File Stream patch management template, a bit like this error.I'm not sure what is going wrong, I see no logs.But I do have one laptop which has the latest version installed. In patch management, it is reported as Unknown. But when I run the script manually, it reports the correct version. Other patch management items have no problems.Now I noticed it has the old name (with File Stream). So I wanted to add the package "Google Drive", but when I press on the (+) button, I get a "404 Page Not Found" error. When I want to add another package (for example "Textmate"), it just works.What is the problem? Do I first have to remove the "Google Drive File Stream" package, before adding the new one? I'm afraid it will still fail... Also, how can I see what's going on. It seems very magical to me right now...  

I am trying to add JAMF script variables to my script, the scripts function is to check user home folders and if it had not been modified in an X amount of days it will delete the folder. I want to be able to change the amount of days depending on the deployment location. Would I simply just need to add $4 to the area where the variable would be input?#!/bin/bash# Set the number of days to 90days=90 (<----- This would just change to days=$4, then in JAMF I would set the amount of days in the first variable section. # Set the excluded usersexcluded_users=("macadmin" "shared" "Shared" "admin")# Get current date in secondsnow=$(date +%s)# Iterate over all users home folderfor dir in /Users/*; do# Check if the folder is a directory and not one of the excluded usersif [ -d "$dir" ] && [[ ! " ${excluded_users[@]} " =~ " $(basename "$dir") " ]]; then# Get the last modified date of the folderlast_modified=$(stat -f "%m" "$dir")# Calculate the difference between the last mo

Hello,I have a user whose computer has "Chrome" and "Slack" listed as separate storage drives. While both Chrome and Slack on running on their machine, Jamf is continuing to list their computer as "unencrypted" since neither the Chrome or Slack "drives" are encrypted. They have also complained that when they update their computer, they have to "reinstall" Chrome and Slack, though I am not sure how relevant that fact is. In any case, this is the only user who has this problem, and we have the same configuration profile running on the same model with different employees without this issue. I'm not even sure how I would recreate this problem on a separate machine, so any advice is appreciated.

Hello!In the Jamf Connect documentation it suggests that some scenarios require scoping a config profile solely during enrollment:Best Practice: Jamf recommends maintaining settings that only should be used during enrollment in a separate configuration profile. This allows you to remove the settings after enrollment without impacting other Jamf Connect settings.My question is this:What's the best way to scope machines into a config profile only during enrollment then immediately remove them from that after? Background: we use prestage enrollments and have an "enrollment only" configuration profile for the Notify Screen to install necessary apps, but that requires resetting the authchanger. We do so in the config profile, but one it's enrolled we no longer want to run the config profile with that authchanger reset. Thank you!